CUPS - 'kerberos' Cross-Site Scripting

Attackers can exploit this issue by enticing an unsuspecting victim into following a malicious URI. The following example URI is available: http://www.example.com/admin/?kerberos=onmouseover=alert source: https://www.securityfocus.com/bid/36958/info CUPS is prone to a cross-site scripting...

WordPress MU 1.2.2 - 1.3.1 'wp-includes/wpmu-functions.php' CSS

Exploit for unknown platform in category web applications ================================================================================ WordPress MU 1.2.2 - 1.3.1 'wp-includes/wpmu-functions.php' Cross-Site Scripting Vulnerability...

WordPress 2.0 - 2.7.1 admin.php Module Configuration Security Bypass

Exploit for unknown platform in category web applications ================================================================================== WordPress 2.0 - 2.7.1 admin.php Module Configuration Security Bypass Vulnerability...

WordPress MU 1.2.2 - 1.3.1 'wp-includes/wpmu-functions.php' Cross-Site Scripting Vulnerability

No description provided by source. An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI. The following proof of concept is available: curl -H "Cookie: my cookies here" -H "Host: body onload=alertString.fromCharCode88,83,83"...

WordPress MU 1.2.2 < 1.3.1 - '/wp-includes/wpmu-functions.php' Cross-Site Scripting

An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI. The following proof of concept is available: curl -H "Cookie: my cookies here" -H "Host: " http://www.example.com/wp-admin/profile.php tmp.html $ firefox tmp.html...

Cross site scripting

Cross-site scripting XSS vulnerability in GejoSoft allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to the default URI in photos/tags...

CVE-2009-3856

Cross-site scripting XSS vulnerability in the default URI in news/ in Twilight CMS before 4.1 allows remote attackers to inject arbitrary web script or HTML via the calendar parameter. NOTE: some of these details are obtained from third party information...

Multiple Browsers Telnet URI Handler File Manipulation (CVE-2004-0411; CVE-2004-0473)

There exists a vulnerability that affects various web-browsers. Insufficient input validation for telnet URI e.g., telnet://hostname can cause the Telnet software activated by the browsers to treat specially crafted Telnet URI as command-line options. As such, a malicious attacker may be able to...

e-Courier CMS Tracking xss

Exploit for unknown platform in category web applications ========================== e-Courier CMS Tracking xss ========================== Vendor: e-Courier http://www.ecouriersoftware.com/ Product: CMS Tracking Site Issue: Cross-Site Scripting. Description: Nearly all pages include the URI...

FreeBSD : KDE -- multiple vulnerabilities (6f358f5a-c7ea-11de-a9f3-0030843d3802)

oCERT reports : Ark input sanitization errors: The KDE archiving tool, Ark, performs insufficient validation which leads to specially crafted archive files, using unknown MIME types, to be rendered using a KHTML instance, this can trigger uncontrolled XMLHTTPRequests to remote sites. IO Slaves...

Stratek Web Design Twilight CMS 4.0 - 'calendar' Cross-Site Scripting

source: https://www.securityfocus.com/bid/41895/info Twilight CMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context ...

KDE -- multiple vulnerabilities

oCERT reports: Ark input sanitization errors: The KDE archiving tool, Ark, performs insufficient validation which leads to specially crafted archive files, using unknown MIME types, to be rendered using a KHTML instance, this can trigger uncontrolled XMLHTTPRequests to remote sites. IO Slaves inp...

Wowd search client multiple variable xss

No description provided by source. Wowd search client multiple variable xss Vendor URL: http://www.wowd.com/ Advisore:http://lostmon.blogspot.com/2009/10/ wowd-search-client-multiple-variable.html Vendor notify:yes exploit available:yes What is Wowd? Wowd is a real-time search engine for...

Dogfood CRM spell.php Remote Command Execution

$Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'Dogfood CRM...

AWStats migrate Remote Command Execution

$Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'AWStats...

TikiWiki tiki-graph_formula Remote Command Execution

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'TikiWiki...

HTTP GET Request URI Fuzzer (Fuzzer Strings)

This module sends a series of HTTP GET request with malicious URIs. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HTTP GET Request URI Fuzzer Fuzzer Strings', 'Description' = %q This module...

KDE multiple security vulnerabilities

Crossaplication scripting in Ark, protocol URI handlers, KMail...

Wowd Search Client 1.3.0 XSS

Exploit for unknown platform in category web applications ============================ Wowd Search Client 1.3.0 XSS ============================ Wowd search client multiple variable xss Vendor URL: http://www.wowd.com/ Vendor notify:yes exploit available:yes What is Wowd? Wowd is a real-time sear...

Wowd Search Client XSS

Wowd search client multiple variable xss Vendor URL: http://www.wowd.com/ Advisore:http://lostmon.blogspot.com/2009/10/ wowd-search-client-multiple-variable.html Vendor notify:yes exploit available:yes What is Wowd? Wowd is a real-time search engine for discovering what's popular on the web right...